China Issues New Rules for Cybersecurity Incident Reporting

On September 11, 2025, the Cyberspace Administration of China (“CAC”) issued the Administrative Measures for Reporting National Cybersecurity Incidents (“AMRNCI”). Jurisdiction and Reporting ObligationsIn the event of a cybersecurity incident, a network operator providing services in China must report the incident to the relevant competent authority. Cybersecurity Incident Notification Procedures and Timing RequirementsThe appropriate incident reporting procedures and timing requirements depend on the type of network operator and level of incident. Where the cybersecurity incident involves criminal or illegal activities, the network operator must also promptly report the incident to the public security authorities. Reporting ChannelThe CAC provides 6 channels for reporting cybersecurity incidents:the cybersecurity incident reporting hotline, “12387”;the official cybersecurity incident reporting website, at cert.org.cn ;; the “12387” mini-program on WeChat;the “National Internet Emergency Center CNCERT” WeChat official account (click “Report Incident”);email 12387@cert.org.cn; andfax to 010-82992387.